Two CVSS 9.2 PHP remote code execution flaws had their technical details leaked before the official patch was ready. The emergency fix ships at 14:00 UTC today - and the window between public exploit detail and patch availability is where mass exploitation happens. That is the lead story, but today also brings a Tor exit node hijacking campaign that intercepted SSH credentials for five days, a certificate authority key compromise forcing browser-wide blocks, and a confirmed supply chain attack on the OVHcloud CLI.

In the News

Critical PHP RCE Pair Leaked Pre-Patch - Mass Exploitation Expected Today

PHP is shipping emergency fixes today for CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. These are unauthenticated remote code execution flaws - the worst category of web server vulnerability. The problem is timing: technical details leaked before the patch was ready. Attackers now have a blueprint for exploitation, and the official fix does not land until 14:00 UTC.

The operational reality for defenders is a race measured in hours. Every internet-facing PHP application server is in scope. Organizations that cannot patch immediately need compensating controls in place now - WAF rules to block known exploitation patterns, network segmentation to limit blast radius, and monitoring for anomalous process execution on web servers. The term “PHP2Shell” is already circulating in exploit development communities, which signals that weaponized proof-of-concept code is either available or imminent.

This is not a case where a 30-day patch cycle is acceptable. If your organization runs PHP on the internet, today’s patch window is the priority.

What defenders should do: Deploy WAF rules as an immediate compensating control. Enumerate every PHP instance across the estate using vulnerability scanning or asset inventory tools. Patch as soon as the emergency release is available at 14:00 UTC. Monitor web server processes for anomalous child process spawning (T1059.004 - Command and Scripting Interpreter: Unix Shell).

Attacker Hijacked 300+ Tor Exit Nodes to Steal SSH Credentials

Between October 1 and October 5, an attacker took control of over 300 Tor exit nodes - approximately 10% of the network’s total exit infrastructure. The compromised nodes performed man-in-the-middle attacks on SSH sessions, intercepting credentials in transit. The Hacker News report confirms the attack was active for a full five-day window before the Tor Project identified and removed the malicious relays.

The implications extend beyond Tor users. This incident demonstrates that anonymity networks carry their own supply-chain risk - the trust model depends on exit node operators being honest, and 10% of that trust was compromised simultaneously. Any organization that routes administrative SSH traffic through Tor (a practice more common in certain threat models than many assume) should treat credentials used during October 1-5 as compromised.

What defenders should do: Rotate SSH credentials used during October 1-5 if any sessions transited Tor. Enforce SSH key-based authentication rather than password authentication (T1078 - Valid Accounts). Deploy network detection for anomalous SSH handshake patterns and unexpected host key changes.

eMudhra CA Private Keys Compromised - Browsers Blocking 8 Intermediate Certificates

Indian certificate authority eMudhra’s intermediate certificate private keys were recoverable - meaning an attacker could reconstruct the keys and forge valid TLS certificates for any domain. Google, Mozilla, and Apple have already pushed updates blocking eight eMudhra intermediate certificates. This is not a theoretical risk - recoverable private keys mean the CA’s entire trust chain is broken.

Organizations using eMudhra-issued certificates will see browser trust failures starting immediately. The remediation is not a patch - it is a full certificate reissuance from a different certificate authority. Any service relying on eMudhra-chained certificates for TLS, code signing, or mutual authentication needs an emergency reissuance plan today.

What defenders should do: Audit your certificate inventory for any certificates chaining to eMudhra intermediates. Reissue affected certificates from a different CA immediately. Implement certificate transparency monitoring to detect unauthorized certificate issuance across all your domains.

OVHcloud CLI Backdoored on GitHub for 94 Minutes - Contributor Account Compromised

The OVHcloud CLI supply chain attack from October 19 is now confirmed as a contributor account compromise, not a build pipeline attack. Five releases were backdoored between 12:47 and 14:21 UTC, and the malicious code exfiltrated secrets from disk on any system where the CLI was installed or updated during that window. The 94-minute window was short, but developer workstations often hold credentials for production systems, cloud APIs, and internal services.

This is the same pattern seen repeatedly in software supply chain attacks: a single contributor account, compromised through means not yet disclosed, becomes the vector for distributing malicious code to downstream consumers. Build provenance verification and release signing - the controls that would have flagged an unexpected release - were not in place or not enforced by consumers.

What defenders should do: If OVHcloud CLI was installed or updated on October 19 between 12:47-14:21 UTC, rotate every credential on the affected system. Implement release signature verification for all CLI tools consumed from GitHub. Review secrets management practices to minimize credentials stored on developer workstations (T1552.001 - Unsecured Credentials: Credentials In Files).

Defender Action Items

  • PHP servers: Patch CVE-2026-109618 and CVE-2026-109619 as soon as the emergency release is available (14:00 UTC today). Deploy WAF rules immediately as a compensating control. Enumerate all PHP instances across your environment.
  • SSH credentials via Tor: If any administrative SSH sessions transited Tor between October 1-5, rotate those credentials now. Enforce key-based SSH authentication.
  • eMudhra certificates: Audit certificate inventory for eMudhra-chained certificates. Begin emergency reissuance from a different CA. Implement certificate transparency monitoring.
  • OVHcloud CLI: If installed/updated October 19 (12:47-14:21 UTC), rotate all credentials on affected systems. Verify release signatures on all GitHub-consumed CLI tools.
  • FortiSIEM (CVE-2026-106173, CVSS 9.4): Public PoC available - patch immediately and restrict management network access.
  • Siemens Software Center (CVE-2026-110936, CVSS 8.4): Actively exploited via ClickFix lures - patch and review for social engineering indicators in OT environments.

Detection Queries

Monitor for anomalous process spawning on PHP-enabled web servers - a common indicator of post-exploitation RCE. This Splunk SPL query identifies web server processes (Apache, Nginx, PHP-FPM) spawning unexpected child processes such as shells, curl, or wget:

index=linux sourcetype=sysmon OR sourcetype=auditd
(parent_process_name IN ("apache2", "httpd", "nginx", "php-fpm", "php-cgi", "php"))
(process_name IN ("sh", "bash", "dash", "curl", "wget", "python*", "perl", "nc", "ncat"))
| stats count by host, parent_process_name, process_name, process_command_line, _time
| where count > 0
| sort -_time

This query has a low false-positive rate in production web server environments because legitimate PHP applications rarely spawn interactive shells or download tools. Tune by excluding known cron jobs or maintenance scripts specific to your environment. Correlate hits with web access logs showing POST requests to unusual endpoints for high-fidelity RCE indicators.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.